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I REAL PARTY IN INTEREST (37 C.F.R. § 41.37{c){l)(i)) 

The reai party in interest in this appeal is McAfee, Inc. 
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H RE LATED APPEALS AND INTERFERENCES (37 CF.R. § 41.37(c) (1 )(»)) 

With respect to other prior or pending appeals, interferences, or related judicial proceedings that 
will directly affect, or be directly affected by, or have a bearing on the Board's decision in the 
pending appeal, there are no other such appeals, interferences, or related judicial proceedings. 

A Related Proceedings Appendix is appended hereto. 
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Mi: STATUS OF CLAIMS (37 C.F.R. § 41.37(c) <I ><iii» 

A. TOTAL NUM BER OF CLA IMS IN APPLICATION 
CLums m the application dte 1-4 e>4 2, 14-20 ami 22-2-S 

B. STA'l I SOK ALL Tilt CLAIMS IN VPPLICATION 

1 CLnvns wtthdiawn fiom consuletation None 

2 Ciasm.s pending 1-4.0-12 54-2<\ and 22-2X 

3 Claims allowed None 

4 Claims rejected 1 4, o-l2, 14-20. and 22-28 
^ Claims cancelled ^ 13, and 21 

C. CLAIMS ON APPEAL 

The claims on appeal are: 1-4, 64.2, 14-20, and 22-28 



See additional status information in the Appendix of Claims. 
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IV STATUS OF AMENDMENTS (37 C.F.R, § 41.37(c)(l)(iv)) 



As to the status of any amendment filed subsequent to final rejection, an amendment was filed 
10/12/2005 in response to a. final Office Action mailed 5/26/2005, and such amendment was 
entered after the filing of an RCE 
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V SUMMARY OF O AIMED SUBJECT MATTER (37 C.F.R. § 4L37(c){l)(v)) 

With respect to a summary of Claim 1, as shown in Figures I„ 3, and 4, a computer program 
product operable to control an c-tnajl client computer to detect e-nuiti piopagated mah\are is 
provided The computer piogram pjoducf includes e-mad generating logic which is opeiabie to 
generate an e-matS message (eg see item 4 of Figure I, etc k as well as compauson logic 
operable to compare the e-mail message with at least one of an address book of a sender of the e- 
mad message and one oi more previously generated e-mad messages front the client computer 
fe g see stem 12 of hgure 3, and stem 32 of Figure 4 etc i See, foi example page 2, line 3fi 
page 3. line 3 et al. 

Additionally, identifying logic is included that is operable to identify whether (i) the e-mail 
message is being sent to more than a threshold number of addressees specified within the address 
book (e.g see item. 14 of Figure 3.. etc ). See., for example, page 3. lines 4-7 et al. Further, the 
identifying logic is also operable to identify whether (ii) the e-mail message contains message 
content having at least a threshold level of similarity to non-identical message content of the 
previously generated e-mail messages being sent to more than a threshold number of addressees 
specified within the address book (e.g. see item 42 of Figure 4. etc }. See, for example, page 3, 
lines 8-1 1 et al. in addition, the identifying logic is also operable to identify whether (iti) the e- 
mail message contains message content having at least a threshold level of similarity to non- 
identical message content of more than a threshold number of the previously generated e-mail 
messages (e.g. see item 42 of Figure 4, etc ). See, for example, page 3, lines 12-14 et al. The 
identifying logic is further operable to identity the email message as potentially containing 
maiware if at least one of items (i), (ii ), and (hi) is identified. See, for example, page 4, lines 24- 
29 eta?. 

Further, the computer program product comprises quarantine queue logic operable to hold the 
previously generated e-mail messages in a quarantine queue (e.g. see item 28 of Figure 3, etc. ) 
for at least a predetermined quarantine period prior to being sent from the client computer. See, 
for example, page 4, lines S~i 2 et al. 
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Wiih respect to a summary of Claim 9, as shown in Figures 1, X and 4, a method of detecting e- 
maii propagated maiware within an e-mail client computer is provided. In use. an e-mail, 
message is generated (e.g. see item 10 of Figure 3, etc. ) and the e-mail message is compared with 
at least one of an address book of a sender of the e-mail message and one or more previously 
generated e-mail messages from the client computer {e.g. see item !2 of Figure 3, and item 32 of 
Figure 4 etc.) See, for example., page 2, line 30 - page 3, line 3 et al. 

Further, it is identified whether (i) the e-mail message is being sent to more than a threshold 
number of addressees specified within the address book (e.g. see item 14 of Figure 7>, etc.), in) 
the e-mail message contains message content having at least a threshold level of similarity to 
non-identical message content of die previously generated e-mail messages being sent to more 
than a threshold number of addressees specified within the address book (e g see item 42 of 
Figure 4, etc.}, and (iii) the e-mail message contains message content having at least a threshold 
level of similarity to non-identical message content of more than a threshold number of the 
previously generated e-mail messages (e.g. see item 42 of Figure 4, etc ). See. for example, page 
3, lines 4-14 et ai. In addition, the email message is identified as potentially containing maiware 
if at least one of items ft), (ii), and (iii) is identified. See, for example, page 4, lines 24-29 et al. 

Still yet, previously generated e-mail messages are held in a quarantine queue (e.g. see item 28 
of Figure 3, etc. ) for at least a predetermined quarantine period prior to being sent from the client 
computer. See, for example, page 4, lines 8-12 et ai. 

With respect to a summary of Claim 17, as shown in Figures L 3, and 4, an apparatus for 
detecting e-mail propagated maiware within a client computer is provided. In use, an e-mail 
generator is operable to generate an e-mail message (e.g. see item 4 of Figure 1, etc.) and a 
comparator is operable to compare the e-mail message with at least one of an address book of a 
sender of the e-mail message and one or more previously generated e-mail messages from the 
client computer (e.g. see item 12 of Figure 3, and item 32 of Figure 4 etc. ). See, for example, 
page 2. line 30 -■ page 3. line 3 et ai. 

Additionally, a maiware identifier is operable to identify whether (i) said e-mail message is being 
sent to more than a threshold number of addressees specified within the address book (e.g. see 
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item ! f ol Figure i etc) (it) the e~mad message e-ontnns message content hawng at least a 
threshold lex el of snndanh to non-identiut) message content oi (he pieuuush genet died e-nidtl 
messages being sent to mote than d Uueshold numbet of addtessees specified withm the address 
book (e ti sec item ^12 of tiguic ! etc > and (iu) the e-mail message vontams message content 
having at least a threshold iesel of similants to non-tdetUKai message content of m<ne titan a 
flnushokl iiumbu oi the piesiousls generated e-mati messages (eg see item 42 oi 1 tgute 4 
etc ) See foi example pa ye 3 lines 4-14 et dl hi addition the malwate identifier is funhej 
operable to tdentifv the email message as potettttalh containing malwaie if at least one of items 
o) uO and <ni) is identified See for example page 4 lines 24-2<) et al 

I utthef a quarantine queue is opeiablo to hold the prewonsK genetated e-mail messages in a 
quaianune queue (eg see item 28 of Fiiiuie > etc } foi at least a pi edetei tinned quanmtuie 
period pi Kn to bemu sent from the client compute* See foi example page 4 line* S- 12 ei al 

With respect to a summars of Claim 2*> as shown tn figure 3 to speed ptoeessmg an e-mail 
message is identified as potential i\ containing malwaie onis if the e-mail message includes an 
executable element teg see item 2o of tsgusc * etc ) see foi example page "\ lines i"-2s et 
al. 

With respect to a summary of Claim 26, as shown in Figure 4, an e-mail message is identified as 
potentially containing malware when the e-mail message and the previously generated e-mail 
messages share a common attachment (e.g. see item 32 of Figure 4, etc.). See, for example, page 

7, line 32 - page 8, line 5 et al. 

With respect to a >iimman of Claim 27, as shown in Haute a message is sent to a malwaie 
computet piotnam prouder to proside a warning of new malware outbreaks when the e-mail 
message is identified as potential H containing malware (e g see item 20 oi Figuse ^ etc ) See, 
foi example page 7, lines jo-H et al 

With respect to a summary' of Claim 28, as shown in Figure 3, a message to the malware 
computer program provider i ncludes a copv of the e-mail message (e.g. see item 20 of Figure 3, 
etc. ). See., for example, page 7, lines 10-13 et al 
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Of course, the above citations are merely examples of the above claim language and should not 
be construed as limiting in any manner. 
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VI GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL (37 C.F.R. § 
4L37{c)(l){vi)) 

Following, under each issue listed, is a concise statement setting forth the corresponding ground 
of rejection. 

Issue # I: The Examiner has objected to the specification as failing to provide proper antecedent 
basis for the claimed subject matter. 

issue ~ 2 The I \ammei has rejected Claims £-4, 0-12, 14-20, and 22-2K undet 3*s I NC 112, 
fust paragraph as fading to comph wrth the written description requirement 

Issue > The Fxaimnei has tejeeted Claims i~3 9-1 1 15, 17-1 ^, 23 and 2o under 3^ l r S C 
i 03(d) a,s being unpatentable o\ei Bates et al H,' S Patent \o b^MCt) m \ievs of Matsh 
(U.S. Patent No. 6,763,462). 

Issue 4 The Fviimner has rejeued < hums -I o 1^ M, 20, 22, and 2"*~2$ under 3^ V $ C 
103(a) as being unpatentable o\ei Bates et al {I S Patent \o o 77<-> 02 I ) in \ieu of Marsh 
if S Patent No o 7o3 402} and further in ueu of Bates et a! «r S Patent No 0,""S\732) 

(hereinafter Bates2). 

Ksue ~ ^ Ihe I vumnei has lejeUed Claims H, lo and 24 under 3^ \ Sf 103(d) as being 
unpatentable oser Bates et a! ii S Patent No o77o02i) in s sew of Mas sh (t S Patent No 
O,~o3,462}, and futthei in uew of Kouznetsov (I, S Patent No o,"2\3"7) 

issue < 6 Ihe f \ammei has i ejected Claim 2"> under ^ I S(. i 0 3(a) as being unpatentable 
o\ei Bates etai (I S Patent No o "7^,021 ), tn \ie\s of Marsh d ' S Pdtent No {."03 402) and 
furthei m Mew of Radatti {I s Patent No 6 4o7) 
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VI I VRGl MEN V (37 C.K K. § 4 i . 37(e)* I )(s it» 

1 he claims of the gioups noted below do not stand ot fail togahet In the pit-sent seajon, 
appellant explains whs the claims of each gioup ate belies ed to be sepatareh patentable 

issue g 1 : 

1 he bxaminer has objected to the specification as failing to pro\ ide propei antecedent basis feu 
the claimed subject matter. 

The i vfimiik't has argued that |tjhe claim limitations legatdmg idenufstng whethei u) in) and 
(ut) in combination is not suppotted bs the specification Appellant tespectfulh disagrees and 
points out that paac <>, lines 12-1 > of the specification states thai "the anti-sirus mechanism o can 
appls the techniques desuibed heiemqftci to icsist mass mailing mahsaie," and also notes that 
page 0 lines 21-22 oi the specification Mates that ' the general purpose computet 200 opetatmg 
undet contiol of a suitable computet piogiam nun fetfonn the abuse desetihed techniques' 
(emphasts added) hor these and othes seasons, support for the combination of f 0 (it) and im) 
claimed in each of the independent claims is psesent Of couise, such citations ate set foitli b\ 
was of example on Is and should not be eonstrued limiting to the claims tn am mannei 

Issue n- 2: 

The Fvnmnei has rejected Claims J -4. o-12, 14-20, and 22-28 undet ^ I S( 112 ilrsl 
paiagiaph, as failing to complv with the wntten deseuptson requuement 

f lump I I'/aws 1-4, 6-12 14-20. oiul 22-2H 

I he fvimtnei has argued that 'there is snppoit ibt each of o > (n) and (ui> tn the alternattse as 
shown tn page ^ line >0 page 8 line 15 of the ptesent specification, but ne\ei as a 
combination' \ppeliant respectful K disagrees and points out that page >\ lines 12-1 1 of the 
specification states thai 'the anti-situs mechanism o can apply the techniques desenbed 
heieuuitet to lesmt mass mailing malwaie" and also notes that page <-\ lines 21-22 of the 



specification states that v the genet al puipose oomputci 2 00 opetatmg under coutiui of a suitable 
computet psogtam nu\ perlotm the abo\e desenbed iecliuiques* (emphasis added) Ihus 
.support foj the combination of (n, (n). and (m) claimed m each of the independent cianns is 
ptesent Of course, such citations aie set forth b\ v>a\ of example oni\ and should not be 
const! ued limiting to tbc claims m am mantift 

Issue # 3: 

The F\aminet has teieaed (Jaims M " £^ l~-£° 23, and 26 undti *M St kH(a) as 

being unpatentable o\er Bates et a! iJT S Patent \o <\~7^<C1), m uew of Marsh fl'S Patent 
No. 6,763,462). 

Group 1: Claims 1-3. 7. 9-11, 15, 17-19. and 23 

in order to establish, a prima facie case of obviousness, three bask criteria must be met First, 
there must be some suggestion or motivation, either in the references themselves or in the 
knowledge generally available to one of ordinary skill in the art, to modify the reference or to 
combine reference teachings Second, there must be a reasonable expectation of success 
Finally, the prior art reference (or references when combined) must teach or suggest all the claim 
limitations. The teaching or suggestion to make the claimed combination and the reasonable 
expectation of success must both be found in the prior art and not based on appellant's 
disclosure. In re VaeckMl F.2d 488.. 20 USPQ2d 14.38 (Fed fir. 1991) 

With respect to the third element of the prima facie case of obviousness, and particularly with 
respect to the independent claims, the Examiner has relied on Col. 9, lines 3-19 from the Bates 
reference to make a prior art showing of appellant \s claimed "comparison logic operable to 
compare said e-mail message with at least one of an address book of a sender of said e-mail 
message and one or more previously generated e-mail messages from said client computer" (see 
this or similar, but not necessarily identical language in the independent claims). 




Appellant respectfully notes that the excerpt from Bates relied on by the Examiner simply 
teaches 'comparing the new e-mail source address with the source addresses of e-mai! received 
during a designated "B" time period 1 (emphasis added). Clearly., in Bates, a new e-mail source 
address is only compared with e-mail received ., which does not meet "comparefmg] said e-mail 
message with at least one of an address book of a sender of said e-mail message and one or more 
pre v iousl y ge nera ted e-mail messages from said client computer'' where "said previously 
generated e-mail messages [are held] in a quarantine queue for at least a predetermined 
quarantine period pnor to being sent from said client compute?." in the context specifically 
claimed by appellant (emphasis added). 

Additionally, with respect to the independent claims, the Examiner has relied on Col. 9, line 64 - 
Col !0\ line 10 from the Bates reference to make a prior art showing of appellant's claimed 
"identifying logic operable to identify whether said e-mail message contains message content 
having at least a threshold level of similarity to n on -identical message content of said previously 
generated e-mail messages being sent to more than a threshold number of addressees specified 
within said address book"' (see this or similar, but not necessarily identical language in the 
independent claims). 
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\ppeiiant inspect fails asset is the excerpt fiom Bates relied on h\ the I xammei meieiv discloses 
' compannuthe content of e-mails that ate The same sue «is the new e-mail with The content of the 
new e-mail" {emphasis added) However appellant clamps a technique vvhete "said e-mail 
message contains message content having at least a threshold le'vei of sitmiatits to non-identical 
message content oi said preuouslv genu a ted e-nunl messages hung sent to mote than a 
thieshold tutmbet of addiessees specified wrthiti said addtess hoviS in the context churned 
(emphasis added) \ppellam notes that simpiv nouheie in Bates is these am disclosure of "e- 
mad messages being sent to mote than a threshold numbei of addtcssees specified within satd 
add) ess book, 1 m the context claimed b\ appellant (emphasis added) 

\dditioualh appellant respectful Iv points out block "X in hg 4 \ of the Bates reference, which 
depicts a detcimmatiou as to whethei oi not the number of users leceiuna e-mail from the same 
souiee addtess dining the 'B ' time penod is gseatei than a designated '"C numbet of recipients 
(Coi l ) hues K )-\2) In Fig 4\ if the detet mi nation in block 98 results m an affirmative, or 
' Yl \ result, the process ski ps block \ \ 4 which 'depicts a determination as to whethei oi not 
substantial similarities m content ate found between the new e-mail and a particular amount of 
satm sized e-mail' <Col ft! lines 1-0 and instead proceeds dneuh to blocls 120, which 
"illustrates mailing the new e-mail as predicted spam' {Col 10 lines 17-18} { leaiiv tins fails 
to meet and e\en rit/i/?o onm from appellant s claimed identifying logic opeiable to identify 
whethei said e-mail message contains message content having at least a thieshold level of 
similarity to non-identical message content of said ptevjousK genet ated e-mail messages being, 
suit to more than a thieshold numbei of addtessees specified within said addiess bool. " as 
claimed < emphasis added). 

With respect to the first element of the ptwui fix is case of ub\ ioiisncss and m paiticulai the 
obv jousness of combining the aforementioned references the iAammei has atgued that it would 
base been obvious to combine Bates with \iatsh because the oidmatv person skilled in the ait 
would have been motivated to punide means of detecting viral spam as suggested b\ Maish, as 
well as giving the usei the final sa\ m vvhat is to be done with detected \nal spam [and that] in 
this combination it would be obvious that the messages would be held in a " quai antine" for a 
predetermined amount ol time puot to sending m oidei for the usu to have the option of deleting 
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the messages detected as being viral spam without sending the messages. " To the contrary, 
appellant respectfully asserts that it would not have been obvious to combine the teachings of the 
Bates and Marsh references, especially in view of the vast evidence to the contrary. 

For example, the Bates reference teaches that l! [i]n accordance with the present invention, 
multiple e-mails are received at a network server intended for multiple clients served by the 
network server'' (see Abstract) and that "[bjloek c ->2 depicts a determination as to whether or iC 
not the number of recipients of the new e-mail is greater that a designated "'A" number of 
recipients. . . [where] a rule designating the "A" number of recipients is preferably included in 
spam filtering rules for the server' (see Bates Col. 8, lines 56-60). On the other hand, the Marsh 
reference teaches that ' the virus detection utility 104 may be an add in program organized into a 
conventional format such as a plug-in for the e-mail application 102" where "[fjor example, the 
virus detection utility 104 [is] stored as a dynamic link library (DLL) tile and... include^] 
routines to execute in conjunction with the e-mail application 102 to perform specific 
operations'" (see Marsh Col. 2, lines 26-33) 

Clearly, in Marsh, the virus detection utility runs on clients in conjunction with email 
applications located on such clients, and utilizes cHent-ba^ (e.g. address books)., 

whereas, in Bates, a server is used to receive emails sent to clients and to predict undesirable 
emails utilizing titles stored on the server. Thus, Marsh clearly teaches away from Bates 
Appellant respectfully points out that it is improper to combine references where the references 
/each away front their combination. In re Grassellh 713 F.2d 732, 743, 218 USPQ 769, 779 
(Fed. Circ. 1983), 

Again, appellant respectful K asserts that at least the first and third elements of the prima facie 
case of obsiousness ha\e not been met, since it would be unuhvious to combine the references, 
as noted aboxe, and the prior art selerences, as relied upon by the Examiner, fail to teach or 
suggest ail of the claim limitations, as noted above. 



Group 2' Ghum 2h 
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Wiih respect to dependent Claim 2o, the Examiner has retied on Col I. line 66 - Col 2, line 7 in 
Bates to make a prior art showing of appellant' s claimed technique "wherein said e-mail message 
is identified as potentially containing malware when said e-mail message and said previously 
generated e-mail messages share a common attachment;' 




Appellant respectfully asserts that such excerpt from Bates only discloses that "other destructive 
attachments can easily be transmitted within a server upon activation of a single client within a 
network " Clearly, only mentioning an attachment, as in Bates, does not even suggest 
appellant's specific claim language, namely that "said e-mail message is identified as potentially 
containing malware when said e-mail message and said previously generated e-mail messages 
coim^ as claimed (emphasis added). 

Again, appellant respectfully asserts that at least the first and third elements of the prima jack 
case of obviousness have not been met, since it would be i/nobvious to combine the ref erences, 
as rioted above, and the prior art references, when combined, fail to teach or suggest all of the 
claim limitations, as noted above. 

Issue # 4: 

The Examiner has rejected Claims 4, (>„ 12. 14, 20, 22, and 27-2S under 35 U.S.C. 103(a) as 
being unpatentable over Bates et al. (U.S. Patent No. 6,779,021 ), in view of Marsh (U.S. Patent 
No 6,763,462), and further in stew of Bates et ai. {U S. Patent No 6,785,732) (Bates2) 

Group ■ I: Ciaum 4, 6, /2. 14, 20, aihi 22 

Appellant respectful iy asserts that such claims are not met by the prior art for the reasons argued 
with respect to Issue #3. Group #1 . 
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\gam appellant respecting asset ts tbat at least the iff si and thud elements of tltt* ptunu /<« 
case of ob\ iousnt-ss ha\e not been met Mnce it would he unchtou^ to combine die references, 
as nored abo\e and the pnor art rdetenecs as relied upon h\ the txammei, fail to teach or 
suggest ail of die claim limitations as noted aboxe 

Group #2; Claim 27 

\\ tth itspc t to dependent (. lajrn 1~ the Lvammcr has tehed on Col S paiaiuaph 1 hi Batcs2 to 
make a pitoi art shovunu ot appellant s claimed techtmiue vlieiem a message is sent to a 
malwaie compute; program proxider to pio\uk a vi as nine til new niah\aie outbreaks whui said 
e-mail message is identified as potentials containing malvate 



\ppellant respeettulh asserts that the e\tupf itom Rates2 tehed upon hv the F\amiuu tneioK 
ch sdoses that f t |i a utus is lotind the ucb ehutit is notified of the wrus {step -i^O) and that 

the appiopnate authorities ma\ be notified of the virus (emphasis added) I bv>e^ et the meje 
dfsciosuit that it a virus is found the appropriate authorities ma\ be notified ot the \uus at. in 
Bares- simph tails to even surest a technique vhticin a message is senr to a malwaie 
eompiitei piogtam ptoMcttt to ptoude a naming ot new tnah\aie outbteaks when said e mail 
message is identified as potentials containing malwaie as claimed b\ appellant (emphasis 
added) Clear h the mere disclosure oi notrhrma. the appropitate authoiitses of the lound \inis. 
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as in Bates2, simply fails to suggest "provtd[tng| a warning of new mahvare outbreaks/' in the 
manner as claimed by appellant (emphasis added; 

Again, appellant respectfully asserts that at least the first and third elements of the prima facie 
ease of obviousness have not been met, since it would be mtchvious to combine the references, 
as noted above, and the prior art references, as relied upon b\ the Examiner, fail to teach or 
suggest all of the claim limitations, as noted above. 

Group w3: Claim 28 

With respect to dependent Claim 28, the Examiner has relied on Col. 8, paragraph 1 in Bates2 
(teptoduced abo\e) to make a prior att show my of appellant's claimed technique v wheiem said 
message to said maluaie compute! prom am provider includes a cops of said e-mail message 

\ppellant respectful! \ asserts that the exceipt fiom Rates2 relied upon b\ the I \ammei mo eh 
discloses that '[ijf a \srus is found the web client is notified of the wins {step 4^0) and that 
'the appmpnate authorities mas be notified of the Vitus " (emphasis added) Hosscset, the 
genital disdosute that if a \irus rs found the appropriate authorities ma\ be notified of the suns 
as in hates2 simpK tails to e\en suggest d specific technique wherein said message to said 
mahsare computer piogram prosider includes a cops of saul e-mail messag e, as claimed bv 
appt llant ( emphasis added ) Cieaih , the meie disclosure of notffs mg the appiopi sate authorities 
of the tound snus, as m Batcs2, sjmph tails to suggest that the 'message to said maluaic 
computer piogiam pioudei includes a cops of said e-mail message/ in the manner as claimed 
bv appellant t emphasis added) 

Again appellant respeetfuih asseits that at least the iiist and thud elements of the pnout facii' 
ease t>f obs iousness have not been met since it \sottid be unofniom to combine the (defences, 
as noted abo\e and the ptsot att lefeiences as tdied upon bs the l\ammer fail to teach or 
suggest ail of the claim limitations as noted abose 

Issue tf 5: 
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The Examiner 1ms rejected Claims 8, 16, and 24 under t5 V SC. 103(a) as being unpatentable 
over Bates etal. (U S Patent No. 6,770 021), i n view of Marsh (U.S. Patent No 6,763.462), and 
further in view of Kouznetsov {U.S. Patent No. 6,~25,377) 

G> o/f/j v /: Claims <V. M. cw t 7 2-/ 

Appeilant respectfully asserts that such claims are not met by the prior art for the reasons argued 
with respect, to Issue #3, Group #1 . 

Again, appellant respectfully asserts that at. least the first and third elements of the prima jade 
case of obviousness have not been met, since it would be unohvious to combine the references, 
as noted above, and the prior art references, as relied upon by the Examiner, fail to teach or 
suggest ail. of the claim limitations, as noted above. 

Issue .# .6; 

fhc Jr\amtncf has rejected Claim 2^ unJet ^ I S C iOi<a) as bemg unpatentable o\cs Bates et 
al <t s Patuu \o Ap'tLM), una-w ofMaishtf S Patent No 6 7<v* 4o2) and fuithet jn 
Mew of Radaiti {I S I afent \o 6 ~o? 4o7) 

Group if- 1: Claim 25 

With respect, to dependent. Claim 25. the Examiner has relied on Col. 1, lines 36-48 of the 
Radatti reference to make a prior art showing of appellant's claimed technique ''wherein said e- 
mail message is identified as potentially containing malware only if said e-mail message includes 
an executable element, to speed processing." 
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has beeii compromised. " (Col . 1, 1 i •:. 36-4 8) 

Specifically.. appellant notes that the Examiner has argued that "Radatti teaches that only 
executable code may contain maiware." Appellant respectfully disagrees and points out that the 
excerpt from Radatti merely discloses that "[a]!! binary executable*, unrevievved shell scripts, 
arui source code accessed from an external network may contain worms, viruses, or trojan 
horses" and that "outside binary executabies, shell scripts, and scanned source code may enter an 
iMerna„Lnetxvork..or..sj.ngie (emphasis added). 

Clearly, disclosing that binary executabies may contain worm, viruses, or Trojan horses, as in 
Radatti, does not suggest that "only ..executable^ may contain maiware.'" as noted by the 
Examiner (emphasis added). Furthermore, simply disclosing that executabies may contain 
worms, viruses, or Trojan horses, as in Radatti, does not specifically teach any sort of e-mail , let 
alone meet appellant's specifically claimed technique "'wherein said e-m.aiLm^sage ts identified 
as potentially containing maiware pnjy.ifj.aid to 
speed processing ; as claimed by appellant {emphasis added). 

Appellant respectfully asserts that at least the third element of the prima fitch' case of 
obviousness has not been met, since the prior art references, as relied upon by the Examiner, fail 
to teach or suggest all of the claim limitations, as noted above. 

In view of the remarks set forth hereinabove, ail of the independent claims are deemed 
allowable, along with any claims depending therefrom 
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VIII CLAIMS APPENDIX (37 C.F.R. § 41,37{c)(l)(viti» 

The text of the claims involved in the appeal (along with associated status information) is set 
forth below: 

i . (Previously Presented) A computer program product operable to control an e-mail 
client computer to detect e-mail propagated mahvare, said computer program product 
comprising: 

e-mail generating logic operable to generate an e-mail message; 

comparison logic operable to compare said e-mail message with at least one of an address 
book of a sender of said e-mail message and one or more previously generated e-mail messages 
from said client computer; and 

identifying logic operable to identify whether: 

(i) said e-mail message is being sent to more than a threshold number of 

addressees specified within said address book: 

fii) said e-mail message contains message content having at least a threshold level 

of similarity to non -identical message content of said previously generated e-mail 

messages being sent to more than a threshold number of addressees specified within said 

address book: and 

(in) said e-mail message contains message content having at least a threshold 
level of similarity to non-identical message content of more than a threshold number of 
said previously generated e-mail messages; 

wherein said identifying logic is further operable to identify said email message as 
potentially containing mahvare if at least one of items (i). (ii), and (iii) is identified; and 
quarantine queue logic operable to hold said previously generated e-mail messages in a 
quarantine queue for at least a predetermined quarantine period prior to being sent from said 
client computer. 

2 (Original* \ computer program product as claimed m J aim 1 u he: ein said e-mail 
message specifies a pluralits of addressees, said compatison logic being operable to compare 
said plurality of addressees with said e-mail address book to determine if said at least a thicshoid 
number of adds es sees has been exceeded 
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3. (Original) A computer program product as claimed in claim I, wherein said at least a 
threshold number of addressees is specified as a proportion of addressees within said address 
book. 

4. (Original) A computer program product as claimed in claim 3, wherein said proportion 
of addressees within said address book is user specified. 

5. {Cancelled) 

6. (Previously Presented) A computer program product as claimed in claim 1, wherein 
said quarantine period is uset specified 

7 tOtiginal) \ computer ptugiam pioUuU as claimed m claim 1, comprising 
confirmation mpm logic opeiahle \%hen said e-mail message is identified as potential 
eontainmu maiwate to venerate a use; message sec km" a confirmation input fu>m a use; of said 
client compute! betore said e-mail message is sent 

8 tOtiginal} -V computer piogram ptudttct as claimed m claim 1 comprising 
administrate! warning logic opeiahle when said e-mail message is identified as potennalh 
containing malwaie to send an admmistiator warning message io an administrate of said client 
computet regatchng said e-maii message 

9 (Piesiousiv Piesented) >\ method of detecting e-mad ptopagated mahvase withm an e- 
marl client computer, said method comprising the steps of 

generating an e-mad message, 

comparing said e-mail message with at least one oi an addtess book of a sender of said e- 
maii message and one or moie preuottsK generated e-mail messages funis said client computer, 
identifying whether: 

(?) said e-mail message is being sent to more than a threshold number of 
addressees specified within said address book; 
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{u} said e-mail message contains message eontuu hawng at least a threshold lex el 
oi similarm to non-identical message content oi said piewousK geneiated e-mail 
messages bemu sent to moje than a threshold numbej of addiessees specified within said 
address book: and 

fit! » saul e-mail message eontams message content haung at least a thteshold 
level ol simiiam\ to non-identical message content ol more than a threshold number uf 
said pre\touslv geneiated e-mail messages, 

wherein said email message i* identified as potentialh containing malware if at 
least one oi items (i } in) and (m) is identified, ami 

holding said pte\tousl\ generated e-mail messages m a quarantine queue for at least a 
predetermined quatantsne peitod prior to being sent horn said client computet 

10 {Oiiuinal) A method as claimed m claim 0 wheiem said e-mail message specifies a 
plutaltSA of addressees, said pluialitx of addressees being compared v\ ilh said e-mail address 
book to determine it said a! leas! a thieshold numbei of addressees has been exceeded 

1 1 tOngmai ) \ method as claimed in claim u , whciem said at least a thicshold numbei 
of addressees is specified as a pioportion of addressees vuthm said addiess book 

12 (.Original) \ method as claimed tn claim ! L wherein said proportion ot addressees 
within said address book is user specified. 

13. (Cancelled) 

14. (Previously Presented) A method as claimed in claim 9, wherein said quarantine 
period is user specified. 

1 5. (Original) A. method as claimed in claim 9, wherein when said e-mail message is 
identified as potentially containing ma! ware, then a user message is generated seeking a 
confirmation input from a user of said cl ient computer before said e-mail message is sent. 
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lo (Original) \ method as c-laimcti in claim 0 ■\\bcicin when said e-mail message is 
identified as potentials containing mah>ate then an adntnnstiatot warning message is sent io an 
administrator of said chent computer tegatdmg said e-mail message 

!7 {PreuoitsK Presented) \pparatus for detecting e-mail propagated ntalwaie within a 
chent computet . said apparatus comprising 

an e-mail generatoi operable to generate an e-mail message, 

a eompaiuoi operable to compare »aid e-mail message with at lea»t otic of an address 
book of a sender of said e-mail message and one 01 mote preuoush genetated e-mail messages 
from said client computer; 

a malw arc identifier opetable to nlentth whether 

(!) satd e-mail message is being sent to more that) a threshold number of 

addte^sces specified within said addtcs> book, 

fti) said e-maii message contains message content basing at least a threshold iexel 

oi sjmtlaritx to non-identical message con ten! oi said piewousix generated e-matl 

messages bemii sent to more than a threshold number of addiessees specified within satd 

address book: and 

On i said e-mail message contains message content haxmg at least a ihieshold 
lesei ol similarttx to non-identical message content ol more than a threshold number of 
sard prexiouslv generated e-mail messages. 

wherein satd malwase identttki ts fuahcr opeiablc to fdentifv satd email message 
as potennaiix containing maluaie if at least one of items (t) (it), and uu) is identified 
and 

a quarantine queue operable to hold saul prestousK generated e-matl messages m a 
quarantine queue for at least a pi cdetei mined quarantine peuod pnoi to being sent fiom said 
client computer 

IS {Original) Appaiatus as claimed in claim I ~" wherein said e-mail message specifies a 
piuiaSth of addressees, satd compatuoi being opes able to compate said plutalm of addressees 
with said e-mail addies» book to detesmme if said at least a threshold number of addiessees ha& 
been exceeded. 
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l 4 ' {Pie\ionsl\ Pteseuted) Appd.ta.tui. as claimed m claim 1 7 \\ hot cm said at least a 
thiesbuid numbei of addiessees is specified as a propoition of addiessees uithin sdid address 

book. 

20. (Original) Apparatus as claimed in claim 19, wherein said proportion of addressees 
within said address book is user specified. 

21. (Cancelled) 

22. (Previously Presented) Apparatus as claimed in claim 17, wherein said quarantine 
period is user specified. 

23. (Original) Apparatus as claimed in claim 17, comprising a confirmation input unit 
operable when said e-mail message is identified as potentially containing mafware to generate a 
user message seeking a confirmation input from a user of said client computer before said e-mail 
message is sent. 

24. (Original) Apparatus as claimed in claim 17, comprising an administrator warning 
unit ope* abb whui sdid e-mail message is identified as potential!) containing maluare to send 
an administrator wanting message to an administrator of said client computer regarding said e- 
masl message. 

25 tPieuoush Piesented) A computer ptogram product as claimed in clasm i wheieiu 
said e-mail message is identified as potential I v containing malware onh if said e-mail message 
includes an executable element, to speed processing 

26 {PrestousK Pitsented) A computer psogram pioduct as claimed m claim i, ulierem 
said e-mail message is identified as potential]) containing malwaie when said e-mail message 
and Sdid pseuouslv generated e-mail messages share a uniimoii attachment 
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21. {Previously Presented) A computer program product as claimed in claim 1, wherein a 
message is sent to a makvare computer program provider to provide a warning of new maiware 
outbreaks when said e-mail message is identified as potentially containing malware 

28 {Previously Presented) A computer program product as claimed in claim 27.. wherein 
said .message to said maiware computet program provider includes a copy of said e-mail 

message. 
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IX EVIDENCE APPENDIX (37 C.F.R. § 41.37{c){l)(ix)) 

There is no such evidence. 
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X RELATED PROCEEDING APPENDIX (37 C.F.R. § 407(c)(l){x)) 

N/A 



In the e\ent a telephone cotnusanon \>ottid expedite me ptoseuition oi t hi s application the 
LXavmner m,n jeaeh the undersigned at ( K>8) f '?l-2^7? Fot p,t\ment ot\in\ additional fees due 
ui connection with the tiling of this paper, the CommtSMoner is aurhon/cu to charge such fVcs to 
Deposit Account No *0-\,*\ (Oidei \n V\UP4<>2> 



Respectfully submitted. 
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